3 ms·

is it common for DNS hosts to provide delegated access at the granularity of individual records? I don't want my webserver to have the ability to change my ent

• Shoothe 9y ago
  In OVH you can restrict token access to individual resources (in this case one record) at token creation time.
• josteink 9y ago
  If you’re doing DNS-based auth you don’t need to renew the certainly on the web-server at all. You can generate them on a secure host (or container) which pushes the certs to the machines which needs them.
• level3 9y ago
  Not sure if it will work for your use case, but you can also CNAME the _acme-challenge record to a different domain (or a subdomain with a separate zonefile), dedicated only to authorizing certificates.